Hi guys,
I have a javascript service that performs a query every 30 seconds:
let service = new this.splunkjs.Service({
username: process.env.SEARCHER_USERNAME,
password: process.env.SEARCHER_PASSWORD,
scheme: process.env.SEARCHER_SCHEME,
host: process.env.SEARCHER_HOST,
port: process.env.SEARCHER_PORT,
version: process.env.SEARCHER_VERSION
});
// Set the search parameters
let searchParams = {
exec_mode: "blocking",
auto_cancel: process.env.SEARCHER_AUTO_CANCEL_JOB_SEC,
output_mode: "JSON",
rf: "*"
};
service.search(
searchQuery,
searchParams,
...
....
......
even If I set SEARCHER_AUTO_CANCEL_JOB_SEC=30
, if I go to Activities/Jobs (in the Splunk Web Application) the job Expires
date is 10 minutes after the Created at
date. I was expecting 30 seconds not 10 minutes.
Splunk version: 6.6.2
Thank you
Hi @faustf,
I haven't used this SEARCHER_AUTO_CANCEL_JOB_SEC
parameter yet, but if you want to reduce the expiration time of your results, limits.conf is the way to go.
See https://answers.splunk.com/answers/52973/how-to-set-search-result-no-expiration.html which answered this previously.
But it will reduce the expiration time for all JOBs.
I would like to do it using the SDK and only for my JOBs.
thank you for your answer
Okay and have you already tried setting the TTL (time to live) of your search job? See http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.0/splunkjs.Service.Job.html under setTTL
for an example.